Linux kernel (drivers/nvme/target): Every command a client sends to the target carrying metadata (protection

Impact

Every command a client sends to the target carrying metadata (protection information) leaks the bio integrity payload permanently. A tenant or peer issuing metadata-bearing I/O in a loop grows kernel slab without bound until the shared storage node runs out of memory.

Who can reach it

Driven entirely by a connected NVMe-oF client's command stream against an exported namespace - the leak is on the normal inline-bio path, not an error path, so no crafted failure is needed. Any peer allowed to connect to the subsystem can drive it. Conditional on the exported namespace supporting metadata/PI, which is the case for formatted-with-PI backing devices.

What to do

Update to 6.11 or later (or a stable branch carrying the linked commits). Interim: export namespaces without protection information where the workload permits, and alert on unexplained kmalloc-128 slab growth on target nodes.

References